Since then, it has become my light-weight network tunneling tool in daily work.
The installation is easy now. You can install it through Mac OSX Homebrew, or Ubuntu apt-get.
brew install sshuttle
I use sshuttle to..
1. Tunnel all traffic
This is the first command I learned. It forwards all TCP traffic and DNS requests to a remote SSH server.
sshuttle --dns -vr ssh_server 0/0
ssh, you can use any server specified in
-v flag means verbose mode.
Besides TCP and DNS, currently
sshuttle does not forward other requests
such as UDP, ICMP ping etc.
2. Tunnel all traffic, but exclude some
You can exclude certain TCP traffic using
sshuttle --dns -vr ssh_server -x 184.108.40.206/24 -x 220.127.116.11 0/0
For instance, when I am in China, I don’t want to tunnel Youku.com traffic to a foreign server, because its movie streaming service is only available within China.
In this case, I use
-x option to exclude Youku.com IP addresses.
3. Tunnel only certain traffic
To tunnel only certain TCP traffic, specify the IP addresses or IP ranges that need tunneling.
sshuttle -vr ssh_server 18.104.22.168/24 22.214.171.124
This command comes in handy, whenever I need to test an app feature (e.g. Netflix movie streaming) which only available in certain countries, or to bypass ISP faulty caches.
4. VPN to office network
I seldom do VPN, but all you need is the remote SSH server with
-NH flags turned on.
sshuttle -NHvr office_ssh_server
-N flag tells sshuttle to figure out by itself the IP subnets to forward,
-H flag to scan for hostnames within remote subnets and store them temporarily in
IP addresses.. troublesome?
Well, I try not to deal with IP addresses manually. So I wrote a few
vpnto) that allow me to use domain names instead of IP addresses:
Tunnel all traffic
Tunnel all traffic, but exclude some
tnlbut youku.com weibo.com
Tunnel only certain traffic
tnlonly netflix.com movies.netflix.com
VPN to office network
The script is available on my GitHub repo.
You can load it into your
~/.bashrc. To override the default tunneling SSH server in the script: